T08 · Insecure Dependencies
- Location
SKILL.md:24- Finding
Unpinned External TTS Dependency Is Executed Without Integrity Verification
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:24-26;scripts/voice.py:24-25, 52-76
Vulnerability Type: Supply-chain risk caused by an unpinned executable dependency
Risk Level: MediumThe documented installation process retrieves
noizai-ttswithout specifying an immutable version, cryptographic digest, signature, or trusted publisher identity:bash # Install the underlying dependency first clawhub install noizai-tts # Then install this Skill clawhub install lubo-feishu-voiceThe Skill locates that dependency at predictable relative paths and executes its
tts.pyscript with the current Python interpreter:python SCRIPT_DIR = Path(__file__).parent TTS_SCRIPT = SCRIPT_DIR.parent / "noizai-tts" / "scripts" / "tts.py" WORKSPACE_MEDIA = Path.home() / ".openclaw" / "workspace" / "media"python # Find TTS script if not TTS_SCRIPT.exists(): # Try alternate path alt = SCRIPT_DIR.parent.parent / "noizai-tts" / "scripts" / "tts.py" if alt.exists(): tts_script = alt else: print(f"Error: tts.py not found at {TTS_SCRIPT} or {alt}", file=sys.stderr) sys.exit(1) else: tts_script = TTS_SCRIPT # Build command cmd = [ python, str(tts_script), "-t", text, "--voice-id", voice_id, "--format", "opus", "-o", str(output) ] # Run — capture stderr separately so it doesn't pollute stdout result = subprocess.run( cmd, capture_output=True, text=True, encoding="utf-8", errors="replace" )Technical Analysis
noizai-ttsis an executable third-party component, not merely passive data. The installation command selects it by a mutable package name, while the wrapper performs no version enforcement or integrity validation before execution. It also accepts either of two relative filesystem locations solely on the basis thattts.pyexists.Consequently, the effe ...[truncated 2310 chars]
- Remediation
View remediation
Remediation Suggestions
- Pin
noizai-ttsto a specific, reviewed, immutable release rather than installing it only by package name. - Record and verify a cryptographic SHA-256 digest or trusted signature for the dependency before installation or execution.
- Verify the package publisher through a trusted registry identity and reject unsigned, unexpectedly republished, or mismatched artifacts.
- Use a dependency lockfile or trusted manifest that records the exact dependency version and integrity metadata.
- Resolve the dependency through an authenticated package-management mechanism instead of searching multiple relative paths.
- Before execution, canonicalize the script path and ensure it resides in the expected installation directory; reject symlinks or unexpected ownership and permission states where practical.
- Vendor the reviewed TTS integration into the Skill when licensing permits, thereby making the executable code part of the auditable artifact.
- Run the TTS dependency in a restricted environment with only the filesystem and network access necessary for synthesis. Avoid passing unrelated secrets through its environment.
- Document the exact reviewed dependency release and establish a controlled update process requiring renewed code review and integrity metadata.
- Pin